neconyd | 56e469b1d255211042e188ee2e31b550_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe
Size 92KB
Sample240605-q2pr2sgh71
SHA256 c159b55c5d9015a74101c2e829275c341c20cb0da9cb30e1a47e7c13b3059ba7
MD5 56e469b1d255211042e188ee2e31b550
SHA1 4d4dc1f1a9d1a2c7cf61e3372a04e660f654e774
SHA512 d2584f18fc8e41de9ed11754c37e1d3f262d4c311fa195b8c2e85928b658a5e4dd8c318f5823272bd0d34e91769e02465454d1f70b4f4040d8890fc1e5b4efff
SSDEEP 1536:Ed9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:8dseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd family
neconyd

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe

File Explorer

56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe

.exe 92KB

56e469b1d255211042e188ee2e31b550_NeikiAnalytics.exe

IMPHASH 08b67a9663d3a8c9505f3b2561bbdd1c
SHA256 c159b55c5d9015a74101c2e829275c341c20cb0da9cb30e1a47e7c13b3059ba7
MD5 56e469b1d255211042e188ee2e31b550
SHA1 4d4dc1f1a9d1a2c7cf61e3372a04e660f654e774
SHA512 d2584f18fc8e41de9ed11754c37e1d3f262d4c311fa195b8c2e85928b658a5e4dd8c318f5823272bd0d34e91769e02465454d1f70b4f4040d8890fc1e5b4efff
SSDEEP 1536:Ed9dseIOcEr3bIvYvZEyF4EEOF6N4yS+AQmZTl/5:8dseIOyEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

HttpSendRequestW InternetConnectW HttpOpenRequestW InternetSetPerSiteCookieDecisionW InternetOpenUrlW InternetAttemptConnect InternetOpenW InternetReadFile InternetClearAllPerSiteCookieDecisions InternetCloseHandle InternetQueryDataAvailable InternetSetOptionW

shlwapi

StrStrIW PathMatchSpecW PathCombineW wvnsprintfW StrStrIA PathRemoveFileSpecW

kernel32

TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetVersionExA HeapReAlloc RtlUnwind WideCharToMultiByte MultiByteToWideChar HeapCreate CopyFileW CreateThread WaitForMultipleObjects GetTickCount DeleteFileW CreateProcessW SetUnhandledExceptionFilter ExitProcess GetLastError LoadLibraryW GetProcAddress Sleep VirtualProtect GetPrivateProfileIntW ExpandEnvironmentStringsW GetPrivateProfileStringW FindFirstFileW SetFilePointer SetEndOfFile GetVersionExW HeapAlloc SetWaitableTimer SystemTimeToFileTime CreateWaitableTimerW FindNextFileW HeapFree ReadFile GetModuleFileNameW GetFileTime WaitForSingleObject GetTimeZoneInformation CreateFileW CloseHandle GetFileSizeEx VirtualFree GetProcessHeap GetCurrentDirectoryW VirtualAlloc VirtualQuery GetSystemTime GetFileSize FindClose WriteFile GetLocalTime GetModuleHandleW GetCommandLineW

user32

GetWindowLongW DispatchMessageW GetForegroundWindow CharLowerW CreateWindowExW FindWindowW PeekMessageW SetForegroundWindow GetSystemMetrics MessageBoxW SetWindowPos SetWindowLongW SetParent

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoCreateInstance OleInitialize CoInitialize

oleaut32

SysFreeString VariantInit SysAllocString VariantClear